Thread: Segmentation fault!?!?!?

Yeah, I don't get this HeapWalking crap. I also don't see an example on MSDN. I saw another thread somewhere suggesting VirtualQueryEx.

I'm working on implementing that to see if it solves the problem. I've never used GlobalAlloc though. Is there some reason to choose that over malloc() or realloc()? You also didn't free (GlobalFree?) the memory when it finishes.

My Bad. I forgot call GlobalFree. Yes, there is definitely a reason why I used GlobalAlloc.GlobalAlloc and LocalAlloc functions provide two blocks of memory: fixed and moveable. Moveable memory could be allocated with the DISCARDABLE flag.When allocating a fixed memory block, the GlobalAlloc and LocalAlloc functions return a pointer to a memory block.

To work with a fixed memory block is same as working with malloc and the free function of CRT. The pointer returned for a fixed block can be used to free the memory allocated without retrieving a handle to that memory, by calling GlobalHandle function. In the case of moveable memory, instead of a pointer, the handle to the memory is returned. This is to provide an abstract layer over the allocated memory. Heap manager can move this memory block within its heap.

Moveable memory blocks are much preferable than fixed memory blocks. The system performance is better if we have minimum heap fragmentation. Fixed blocks get allocated at the bottom of the heap, and moveable blocks get locked down at the top. By marking your block moveable, once it has been freed, that free space will quickly be reused by other locked moveable blocks. If another fixed block is allocated, then when the first block is released, it will cause a hole to be created in the fixed memory area.

In brief, moveable means that a block may be moved in memory during a heap compaction to provide sufficient free space for other allocation requests. Discardable means that a block may be stored to disk and retrieved later, when needed again. Locked memory blocks are not moved or discarded. A fixed memory block will never be moved or discarded.

Also, check this post. It may be of some help to you. Finally, I also could not figure out how to use HeapWalk to traverse the dynamic memory of a remote process.

Originally Posted by Elysia

I don't really recommend GlobalAlloc & things. They are unportable and it is obvious you do not need it for your purposes.

Well even Windows Mobile supports GlobalAlloc() so it isn't that unportable. For clipboard operations you actually have to use GlobalAlloc() exclusively. The HeapWalking stuff is soooo grossly underdocumented by microsoft that it isn't even funny (which is why I didn't even dignify them enough to capitalize their name).

I find it hard to believe that there aren't any decent examples of how to determine the size of a process and dump ALL of its memory like all these cheat search tools do.

The heap walking isn't hard if you just apply yourself a little. Here's a crude implementation that'll search the heap memory and main module of whatever process the code is in (obviously it's own if you just compile and run this).

I'm not so sure this code is totally reliable. I've changed the value of the val int to 9999 and it did not find it. I've also tried accessing a remote process to find a global int variable with the value of 9999 and it did not find it.

I've been testing the code both ways. But even accessing the local process does not always produce a found memory location:

Code:

The int 101 was found at the following locations:
0042341C
00423448
00424A58
00424C7C
00425A08

The following values used for val in a local process are not found in memory:

98765
45678
12345
23456
34567
35471

I find it hard to believe that there aren't any decent examples of how to determine the size of a process and dump ALL of its memory like all these cheat search tools do.

I'll probably get in trouble with the mods for demonstrating cheat search tools 101. But anyway, the first listing is the target executable. The variable is initially set to "Bob". Start the target executable and then run the second executable which will change this variable from "Bob" to "Ted". Hitting any key in the target executable will display the new value which is "Ted".

The second executable will need the ProcessId of the the target as command line input.

Code:

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <conio.h>
char test[4] = {"Bob"};
int main(void)
{
	printf("Before WriteProcessmemory update %s\n\n Hit any key to display new value\n\n", test);
	getch();
	printf("After WriteProcessMemory update  %s\n", test);
	getch();
	return 0;
}

Code:

#pragma comment(lib, "advapi32.lib")
#pragma comment(lib, "psapi.lib")

#include <windows.h>
#include <stdio.h>
#include <psapi.h>
// Binary equivalent of "Bob" which is used in search 
const BYTE bPattern[3]={0x42, 0x6f, 0x62};

BOOL EnableTokenPrivilege (LPTSTR privilege)
{
	HANDLE hToken;                        
	TOKEN_PRIVILEGES token_privileges;                  
	DWORD dwSize;                        
	ZeroMemory (&token_privileges, sizeof (token_privileges));
	token_privileges.PrivilegeCount = 1;
	if ( !OpenProcessToken (GetCurrentProcess(), TOKEN_ALL_ACCESS, &hToken))
		return FALSE;
	if (!LookupPrivilegeValue ( NULL, privilege, &token_privileges.Privileges[0].Luid))
	{ 
		CloseHandle (hToken);
		return FALSE;
	}

	token_privileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
	if (!AdjustTokenPrivileges ( hToken, FALSE, &token_privileges, 0, NULL, &dwSize))
	{ 
		CloseHandle (hToken);
		return FALSE;
	}
	CloseHandle (hToken);
	return TRUE;
}

BOOL SearchProcessMemory(int iProcessId)
{
	DWORD  cbRead, cbNeeded, iIndex;
	HMODULE hModule;
	MODULEINFO ModuleInfo;
	BYTE *bBuffer = 0; 
	HANDLE hProcess=OpenProcess(PROCESS_ALL_ACCESS,FALSE, iProcessId);
	EnumProcessModules(hProcess, &hModule, sizeof(hModule), &cbNeeded);
	GetModuleInformation(hProcess, hModule, &ModuleInfo, sizeof(MODULEINFO));
	bBuffer = (LPBYTE)GlobalAlloc(GMEM_FIXED, ModuleInfo.SizeOfImage+1);
	ReadProcessMemory(hProcess, ModuleInfo.lpBaseOfDll, bBuffer, ModuleInfo.SizeOfImage, &cbRead);
	//Search the entire memory of our target process
	for( iIndex = 0; iIndex < ModuleInfo.SizeOfImage; iIndex++)
	{
		if (!memcmp(&bBuffer[iIndex], bPattern, 3))
		{ 
			// calculate of lpBaseOfDll (start of exe + i)
			DWORD dwFoundAtAddress = (DWORD)ModuleInfo.lpBaseOfDll + iIndex;
			printf("we found it at 0x%2X\n", dwFoundAtAddress);
			// Binary equivalent of "Ted"
			const BYTE bPatternOut[3]={0x54, 0x65, 0x64};
			DWORD dwOrgProtect;
			// By default memory is read only, change it to read/write
			if(!VirtualProtectEx(hProcess,(LPVOID) dwFoundAtAddress , sizeof(bPatternOut), PAGE_READWRITE, &dwOrgProtect ))
			{
				printf("Virtual protect failed error %d\n", GetLastError());
				return FALSE;
			}   
			if (!WriteProcessMemory(hProcess, (LPVOID) dwFoundAtAddress, &bPatternOut, 3, &cbRead))
				printf("WriteProcessMemory error %d\n", GetLastError());
			else    printf("WriteProcessMemory successful\n");
			// Change memory back to read only
			VirtualProtectEx(hProcess, (LPVOID) dwFoundAtAddress ,sizeof(bPatternOut) , dwOrgProtect , &dwOrgProtect );
			return TRUE;
		}
	}
	return FALSE;
}

int main(int argc, char **argv)
{
	if ( !EnableTokenPrivilege (SE_DEBUG_NAME) )
	{
		printf ( "Cannot get required privilege %lu\n", GetLastError () );
		return 0;
	}
	if(SearchProcessMemory(atoi(argv[1])) == FALSE)
		printf("Binary signature NOT found\n");
	return 0;
}